First, demand:using Ida to import a C + + header file, add a struct in the header file, replace the offset in the disassembly with the function in this struct body, is the file more readable!!!!
Second, step:Step One: click IdaPro menu item "file->load file->parse C header File" Select Jni.h header Files
Step Two: Simply modify the jni.h, comment on line 27th of the #include<stdarg.h>, and the 1122 lines of the # define JNIEXPORT_ATTRIBUTE_ ((Visibility ("default")) Change to #define JNIEXPORT can be successfully imported after modifying {files saved in C:\Program files (x86) \ida 6.6\tools}
step three: After the successful import, change the jni.h changes back to prevent the compilation of the NDK error.
Step Four: Click on the "Structures" tab on the IDA Pro main interface and press the INSERT key to open the "Create structure/union" dialog, click on the "ADD Standard structure" button on the interface, In the Open Structure Selection dialog box, select Jninativeinterface and click OK to return, the same jniinvokeinterface structure is also imported;
The header file in jni.h has since been successfully added to IDA, but it has been found that the F5 disassembly code is offset and not converted to a function call.
Here are the results of your experiment: 5. Open the Jni_onload () function of So, as follows, note that the parameter of the Jni_onloade () function here is __javavm*, if not _javavm*use figure II to convert it to _javavm* .
Figure one uses "C" to convert it to code
Figure II
6. The following is the disassembly result found that the function has already appeared.
Note: The above is successful after the operation, the possible parameters, and the function are converted successfully, the following reopen the IDA demo 7. Introduce the Java_com_droider_jnimethods_testjnimethods_test function and parse the JNI function called.
8. The source code found that the first parameter of the function is jnienv*, then what is the return code? What do I need to convert?
The returned assembly gets the function: 9. , the first problem solved
Figure A
Figure II
Note: This should be imported into the jni.h and inserted into the structures window.
10. The second question: we should convert __jnienv, and we can see
4 _jnienv struct {const struct jninativeinterface *functions;} 4
|
inside the _jnienv isJninativeinterface, but cannot be converted to Jninativeinterface, because the address of _jnienv is recorded in the stack and in memory, the address of Jninativeinterface is only used for reference. Note: The conversion method is that the mouse clicks on the parameter, then right-selects convert to Struct *
It's over! it worked,!!!!!!.
"Ida" uses the IDA load file feature to import JNI.h parsing "JNI functions"
